We didn't encrypt your password, we hashed it

Re:We didn't encrypt your password, we hashed it by trickstra on Saturday September 05, 2020 @01:17AM (#24381555)

Yes, but that would be OK if the login form truncated the password in the same way as the password change form. They'd both arrive at the same hash. Which is what the comment above you said. What you describe probably means the password change form actually did run the hash on the full length, while the login form truncated it.

[ Parent | on HN ]

Re:We didn't encrypt your password, we hashed it by JanisL on Saturday September 05, 2020 @01:27PM (#24385278)

This is definitely not OK because it reduces the entropy of the passwords without the user knowing this has happened.

[ Parent | on HN ]

Re:We didn't encrypt your password, we hashed it by trickstra on Monday September 07, 2020 @12:23AM (#24396624)

I never said it's OK, I just explained what's happening.

Ah, now I understand why I got those downvotes. What I meant by "OK" was that it would "work". It wouldn't exhibit the behavior my parent comment was describing. Not that it would be secure or good practice.

[ Parent | on HN ]

Re:We didn't encrypt your password, we hashed it by JanisL on Tuesday September 08, 2020 @11:50AM (#24409577)

Ah that makes more sense, thanks for clarifying.

[ Parent | on HN ]

Re:We didn't encrypt your password, we hashed it by davchana on Saturday September 05, 2020 @06:48AM (#24382694)

No, login form did not truncated, it showed javascript error toast that password is longer than acceptable.

The initial signup also checked & showed that toast. But the 90 day reset page did not.

[ Parent | on HN ]